Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina

Vulnerability

Modelina, a library for generating data models from AsyncAPI, OpenAPI, or JSON Schema documents, is vulnerable to code injection in versions prior to 1.0.0. The bug occurs because the library does not sufficiently sanitize or escape user-provided property names or content when using default presets, allowing an attacker to inject arbitrary code into the generated output. As noted in the advisory, users have access to the original raw information, making total prevention difficult [2][3].

Exploitation

An attacker can craft malicious input, such as a JSON Schema with a property name containing injected code, as shown in the maintainer's example: 'property: any; \n constructor(){console.log("injected")} \n private _temp'. When processed with default presets, the generated code (e.g., TypeScript) includes the injected payload verbatim. No authentication is required beyond the ability to provide the schema input [3].

Impact

Successful exploitation allows an attacker to inject and execute arbitrary code within the language output (e.g., JavaScript/TypeScript) generated by Modelina. This can lead to arbitrary code execution in downstream systems or applications that consume the generated models. The impact is severe as it affects any user relying on default presets without custom sanitization [1][2].

Mitigation

The issue is partially mitigated in Modelina version 1.0.0, where using only constrained models prevents the vulnerability. The maintainers recommend fully custom presets that escape user input, as similar injection scenarios are considered intended behavior beyond version 1. There is no complete patch; users must adopt workarounds to stay secure [2][3].